Rule to select sender starting with string

[Al Danks <ad...@calvin.edu>]

We are getting a lot of spam where the sender domain name changes, but the
sender always starts with a specific string.

We've only done a little bit of custom rule writing. How do we do a rule to get
the sender starting with a specific string?

Thanks, Al

Re: Rule to select sender starting with string

[Matt Kettler <mk...@comcast.net>]

Andrew wrote:
> Matt Kettler wrote:
>> Al Danks wrote:
>>
>>> Matt Kettler <mkettler <at> evi-inc.com> writes:
>>>
>>>
>>>  
>>>
>>>> Try a rule something like this:
>>>>
>>>> L_FROM_STRING header From =~ /$string/
>>>>
>>>>
>>>>    
>>>
>>> It appears that the rule is also hitting senders with the string
>>> following a .
>>>
>>> I.e. From =~ /$com/ hits
>>> comalksdfl.net
>>>
>>> aksafjdla.com
>>>  
>>
>>
>> Interesting.. that shouldn't happen with the $ there.. I'll have to test
>> that, unless Theo or one of the other devs can offer an explanation as
>> to why..
>>
>>
>
> Are SA regexes different from other regexes? If not, use '^' to
> specify the beginning of a string and '$' its end. Try this pattern:
> /^com/
>
You're right Andrew.  I had a brain-cylinder misfire there..

Sorry Al, try it with ^ instead of $

Re: Rule to select sender starting with string

[Andrew <an...@arda.homeunix.net>]

Matt Kettler wrote:
> Al Danks wrote:
> 
>>Matt Kettler <mkettler <at> evi-inc.com> writes:
>>
>> 
>>  
>>
>>>Try a rule something like this:
>>>
>>>L_FROM_STRING header From =~ /$string/
>>>
>>>
>>>    
>>
>>It appears that the rule is also hitting senders with the string following a .
>>
>>I.e. From =~ /$com/ hits 
>>
>>comalksdfl.net
>>
>>aksafjdla.com
>>  
> 
> 
> Interesting.. that shouldn't happen with the $ there.. I'll have to test
> that, unless Theo or one of the other devs can offer an explanation as
> to why..
> 
> 

Are SA regexes different from other regexes? If not, use '^' to specify 
the beginning of a string and '$' its end. Try this pattern:
/^com/

Andrew

Re: Rule to select sender starting with string

[Matt Kettler <mk...@comcast.net>]

Al Danks wrote:
> Matt Kettler <mkettler <at> evi-inc.com> writes:
>
>  
>   
>> Try a rule something like this:
>>
>> L_FROM_STRING header From =~ /$string/
>>
>>
>>     
>
> It appears that the rule is also hitting senders with the string following a .
>
> I.e. From =~ /$com/ hits 
>
> comalksdfl.net
>
> aksafjdla.com
>   

Interesting.. that shouldn't happen with the $ there.. I'll have to test
that, unless Theo or one of the other devs can offer an explanation as
to why..

Re: Rule to select sender starting with string

[Al Danks <ad...@calvin.edu>]

Matt Kettler <mkettler <at> evi-inc.com> writes:

 
> Try a rule something like this:
> 
> L_FROM_STRING header From =~ /$string/
> 
> 

It appears that the rule is also hitting senders with the string following a .

I.e. From =~ /$com/ hits 

comalksdfl.net

aksafjdla.com

Al

Re: Rule to select sender starting with string

[Matt Kettler <mk...@evi-inc.com>]

Al Danks wrote:
> We are getting a lot of spam where the sender domain name changes, but the
> sender always starts with a specific string.
> 
> We've only done a little bit of custom rule writing. How do we do a rule to get
> the sender starting with a specific string?

Try a rule something like this:

L_FROM_STRING header From =~ /$string/

Re: Rule to select sender starting with string

[Mike Jackson <mj...@mightymerchant.com>]

> We are getting a lot of spam where the sender domain name changes, but the
> sender always starts with a specific string.
>
> We've only done a little bit of custom rule writing. How do we do a rule 
> to get
> the sender starting with a specific string?

You could probably just do something like this:

blacklist_from foo@*